Project secrets and environment values

Project environment values are stored separately from normal source files and encrypted before storage. Public project files, exports and read-only API file endpoints are not intended to reveal secret values.

• Do not paste provider keys into frontend source files.
• Use public environment values only for configuration that is safe to expose in a browser.
• Rotate any credential that may have appeared in a message, source file or public deployment.
• Keep different credentials for testing and production when the provider supports it.

The Developer API blocks environment files, private key formats, credential filenames and paths containing secret-like names. Sensitive fields are removed from event payloads before they leave the API.